Regulatory Watch
New laws, rules, guidance, enforcement actions and court decisions in privacy, AI and cybersecurity. Every item links to its primary source.
Showing 24 of 214 developments
ADTP REGULATORY BRIEF
CNIL hosts 2nd Rencontres Informatique & Libertés on connected glasses and data‑sanctions
The conference highlights emerging privacy challenges of wearable tech and the increasing enforcement activity of the CNIL.
ADTP REGULATORY BRIEF
Italian DPA fines IQVIA €7 million for unlawful processing of patients’ health data
The fine highlights enforcement of GDPR obligations for health data controllers and underscores the need for proper legal bases, transparency, and impact assessments.
ADTP REGULATORY BRIEF
Commission holds special meeting of Scientific Panel on frontier AI safety and risks
The meeting signals EU commitment to strengthen AI governance through scientific input on systemic risk.
ADTP REGULATORY BRIEF
EFF warns age‑verification laws risk excluding people without ID
Age‑verification regimes may protect children but also threaten equal access to information and privacy for people without ID.
ADTP REGULATORY BRIEF
Swedish DPA fines Miljödata approx EUR 160,000 for insufficient security measures
The fine underscores the enforcement of GDPR security obligations for data processors handling large volumes of personal and sensitive data.
ADTP REGULATORY BRIEF
Hellenic DPA fines Ministry and EETAA for data breach
The enforcement action highlights the liability of both controllers and processors for inadequate security and non‑compliant processing agreements under the GDPR.
ADTP REGULATORY BRIEF
CNIL closes injunction against FRANCE TRAVAIL after compliance with data security measures
The closure shows that timely remediation of GDPR security deficiencies can halt additional penalties.
ADTP REGULATORY BRIEF
AEPD publishes second issue of scientific journal “Privacy, Innovation and Technology”
The publication provides expert analysis of GDPR challenges and AI governance, helping practitioners anticipate regulatory impacts of emerging technologies.
ADTP REGULATORY BRIEF
AEPD issues warnings to two Spanish municipalities over AI‑enabled video surveillance projects
The action highlights the need for data‑protection‑by‑design and proportionality when deploying AI‑driven video surveillance in the public sector.
ADTP REGULATORY BRIEF
Future of Privacy Forum urges standardized privacy benchmarks for frontier AI systems
Standardized privacy benchmarks would give concrete, comparable metrics for AI developers and deployers, supporting better privacy protection and regulatory oversight.
ADTP REGULATORY BRIEF
Ecuador orders security expert Ola Bini deported and bans return for 10 years
The case highlights the vulnerability of security researchers to arbitrary state actions, raising concerns for digital rights and cybersecurity practitioners.
ADTP REGULATORY BRIEF
CNIL explains when data‑breach victims can claim compensation under the GDPR
Understanding the CNIL’s guidance helps data‑controllers and processors assess liability and prepare for potential court‑ordered damages.
ADTP REGULATORY BRIEF
CNIL to examine draft decree on student violence questionnaire and automated vehicle sound monitoring
The agenda signals upcoming French regulatory scrutiny of new personal data processing tools in education and transport sectors.
ADTP REGULATORY BRIEF
CNIL and Cybermalveillance.gouv.fr release guide for individuals on personal data breach response
The new CNIL guide equips citizens with clear steps to mitigate risks after a personal data breach, strengthening individual data‑privacy protection.
ADTP REGULATORY BRIEF
ENISA launches podcast series on Frontier AI and publishes guidance note on cybersecurity in the Frontier AI era
The launch and accompanying guidance highlight ENISA’s effort to inform stakeholders about AI‑related cybersecurity risks and recommended actions.
ADTP REGULATORY BRIEF
Commission designates ChatGPT, Reddit, Roblox as VLOPs/VLOSE under the Digital Services Act
The designations trigger new DSA compliance duties for major online services, affecting their risk‑management and user‑protection obligations.
ADTP REGULATORY BRIEF
ENISA releases 2026 Threat Landscape report highlighting AI-enabled cyber threats and supply‑chain risks
The report informs EU stakeholders of evolving cyber threats, emphasizing the need for heightened vigilance and resilience across digital services.
ADTP REGULATORY BRIEF
EU Commission proposes KIDS Act to impose age‑based restrictions and safety‑by‑design for children online
The KIDS Act aims to create EU‑wide, age‑based safeguards and design obligations to protect children’s privacy and safety online.
ADTP REGULATORY BRIEF
How to limit Siri AI access in iOS 27
The article explains how iOS 27’s Siri AI expands data access and provides step‑by‑step controls for users to protect their privacy.
ADTP REGULATORY BRIEF
EFF warns that cloud TEEs undermine end‑to‑end encryption in messaging apps
The article highlights a privacy risk where AI features offload encrypted messages to cloud TEEs, weakening end‑to‑end encryption protections.
ADTP REGULATORY BRIEF
CNIL outlines its status, organization and sanction powers
The notice details CNIL’s enforcement authority and the maximum GDPR fines, important for data protection compliance.
ADTP REGULATORY BRIEF
EU AI Board discusses AI Act implementation and publishes Action Plan on cybersecurity and AI
The meeting signals EU progress on AI governance, linking AI Act enforcement with a new cybersecurity‑AI action plan.
ADTP REGULATORY BRIEF
EU Cyber Resilience Act reporting obligations take effect for manufacturers
The EU Cyber Resilience Act now imposes mandatory incident reporting duties on manufacturers, raising compliance requirements for product security.
ADTP REGULATORY BRIEF
ENISA launches Single Reporting Platform for Cyber Resilience Act reporting
The SRP provides a single, EU‑wide tool for manufacturers to meet CRA reporting duties, enhancing coordinated cybersecurity risk management.
Source: LiveThreat Regulatory Intelligence, analysed by ADTP. Briefs summarize the linked source and are not legal advice; the linked source is the authority. Dates appear only when the source states them.